REMARKS 



The Examiner has rejected Claims 1, 2, 5, 1 1, 15, 16, 19, 25, 29, 30, 33, 39 and 45-49 
under 35 U.S.C. 103(a) as being unpatentable over Welch, Jr. et al. (U.S. Patent No. 5,862,335), 
in view of Meadway et al. (U.S. Patent No. 6,675,205). Applicant respectfully disagrees with 
such rejection. 

With respect to the independent claims, the Examiner has relied on Col. 4, lines 18-25 
from Meadway (excerpted below) to make a prior art showing of applicant's claimed 
"performing an action associated with a suspicious pattern of activity when the suspicious 
pattern of activity is detected in the peer-to-peer network" (see this or similar, but not necessarily 
identical language in the independent claims). 

"...the update servers store the digital signature of the agent program 
and also store the remote web hosts' last local index, which are 
utilized during the updating of the remote agent program and during 
updating the local index , as will also be discussed in more detail 
below. Each of the update servers 222 applies all index change 
transactions through a firewall/router 224 to the master index server 
218 which, in turn, updates the central search index and then 
distributes those changes to the various index servers sets 216." (Col. 
4, lines 17-25 - emphasis added) . 

As shown above, the excerpt from Meadway relied on by the Examiner only relates to 
updating an index, and specifically teaches that "the remote web hosts' last local index is ufilizcd 
during the updating of the remote agent program and during updating the local index " (emphasis 
added). Clearly, updating an index does not even suggest "a suspicious pattern of activity," let 
alone "performing an action associated with a suspicious pattern of activity when the suspicious 
pattern of activity is detected in the peer-to-peer network " (emphasis added), as applicant claims. 

Fiarther, with respect to the independent claims, the Examiner has relied on Col. 2, lines 
35-40 (excerpted below) and Col. 4, lines 18-25 (excerpted above) from the Meadway reference 
to make a prior art showing of applicant's claimed technique "wherein the suspicious pattern of 
activity is defined in terms of a configuration of shared data on a peer, the configuration 
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establishing a baseline of authorized shares and permissions in association with the shared data" 
(see this or similar, but not necessarily identical language in the independent claims). 

"To allow operation of the invented file sharing system without 
compromising the firewall, the agent program is configured to behave as 
follows. The agent reports to the central server the identities of files 
on the computer that will be provided if requested by others ." (Col. 2, 

lines 35-40 - emphasis added) 

As noted above, Col. 4, lines 18-25 from Meadway, as relied on by the Examiner, only 
relate to updating an index . Additionally, Col. 2, lines 35-40 from Meadway, as also relied on 
by the Examiner, simply discloses that an "agent reports to the central server the identities of 
files on the computer that will be provided if requested by others " (emphasis added). Clearly, 
updating an index and reporting the identities of files that will be provided if requested by others, 
as in Meadway, does not specifically teach a "suspicious pattern of activity," and especially does 
not teach that " the suspicious pattern of activity is defined in terms of a configuration of shared 
data on a peer, the configuration establishing a baseline of authorized shares and permissions in 
association with the shared data" (emphasis added), as claimed. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, 
there must be some suggestion or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to modify the reference or to 
combine reference teachings. Second, there must be a reasonable expectation of success. 
Finally, the prior art reference (or references when combined) must teach or suggest all the claim 
limitations. The teaching or suggestion to make the claimed combination and the reasonable 
expectation of success must both be found in the prior art and not based on applicant's 
disclosure. In re Vaeck,9Al F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Applicant respectfijUy asserts that at least the third element of the prima facie case of 
obviousness has not been met, since the prior art excerpts, as relied upon by the Examiner, fail to 
teach or suggest all of the claim limitations, as noted above. Nevertheless, despite such 
paramoimt deficiencies and in the spirit of expediting the prosecution of the present application. 
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applicant has amended the independent claims to fiirther distinguish applicant's claim language 
from the prior art reference excerpts relied on by the Examiner reference, as follows: 

"the suspicious pattern of activity defined by a set of rules for detecting at least one of 
Trojan horse code, viruses, a user browsing data across peers, unwanted user activity, and 
malicious code attempting to contact a home location" (see this or similar, but not necessarily 
identical language in the independent claims). 

Applicant again respectfiilly asserts that Meadway's mere disclosure of updating an 
index does not even suggest a " suspicious pattern of activity" where "the suspicious pattern of 
activity [is] defined by a set of rules for detecting at least one of Trojan horse code, viruses, a 
user browsing data across peers, unwanted user activity, and malicious code attempting to 
contact a home location" (emphasis added), as claimed. 

Thus, since at least the third element of the prima facie case of obviousness has not been 
met, especially in view of the amendment made hereinabove to the independent claims, a notice 
of allowance or a proper prior art showing of all of applicant's claim limitations, in combination 
with the remaining claim elements, is respectfiilly requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new Claims 
50-52 below, which are added for fiill consideration: 

"wherein the suspicious pattern of activity includes a number of failed attempts 
by a computer in accessing an internal peer that exceeds a predetermined number" (see 
Claim 50); 

"wherein the suspicious pattern of activity includes more than a pre-defined 
number of internal computers requesting resolution of a single external address within a 
preset period of time" (see Claim 51); and 
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"wherein the share configuration loop is executed in parallel with a network 
traffic loop that detects incoming or outgoing network traffic from a computer as 
exhibiting an activity pattern defined as suspicious by a rule" (see Claim 52). 

Again, a notice of allowance or a proper prior art showing of all of applicant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

To this end, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are fiirther deemed allowable, in view of their dependence on such 
independent claims. 

In the event a telephone conversation would expedite the prosecution of this application, 
the Examiner may reach the undersigned at (408) 971-2573. The Commissioner is authorized to 
charge any additional fees or credit any overpayment to Deposit Account No. 50-135 1 (Order 
NO.NAI1P344). 

Respectfully submitted, 
Zilka-Kotab, PC 

/KEVINZILKA/ 

Kevin J. Zilka 

P.O. Box 721120 Registration No. 41,429 

San Jose, CA 95172-1120 

408-971-2573 
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